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1. In a computer system that includes a mass storage device that stores a 
plurality of data blocks, a method of updating the data blocks while enabling a previous 
state of the mass storage device to be accessible, comprising the acts of: 

receiving a write request that is to overwrite an existing data block in the 
mass storage device with a new data block; 

prior to executing the write request, storing a copy of the existing data 
block in a preservation memory associated with the computer system and 
associating a time stamp with the copy of the data block in the preservation 
memory; and 

executing the write request, such that the existing data block stored in the 
mass storage device is overwritten with the new data block. 

2. A method as recited in claim 1, wherein the preservation memory 
comprises a volatile memory device. 

3. A method as recited in claim 1, wherein the preservation memory 
comprises a portion of the mass storage device. 

4. A method as recited in claim 1, further comprising the act of creating a 
backup copy of the plurality of data blocks stored by the mass storage device prior to the 
act of receiving the write request. 

5. A method as recited in claim 6, wherein the act of creating the backup 
copy is conducted when the plurality of data blocks represent logically consistent data. 
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6. A method as recited in claim 1, further comprising the act of restoring the 
plurality of data blocks stored at the mass storage device to a state in which the plurality 
of data blocks existed at a previous point in time using the copy of the existing data block 
stored by the preservation memory. 

7. A method as recited in claim 1, further comprising the act of storing a 
sequence of existing data blocks in the preservation memory in response to one or more 
write requests that are to overwrite the existing data blocks at the mass storage device and 
associating a time stamp with each of the existing data blocks of the sequence. 

8. A method as recited in claim 7, further comprising the act of restoring the 
plurality of data blocks stored at the mass storage device to a state in which the plurality 
of data blocks existed at a previous point in time using the sequence of existing data 
blocks stored in the preservation memory. 

9. A method as recited in claim 8, further comprising the act of experiencing 
a data corruption event in the mass storage device, wherein the act of restoring the 
plurality of data blocks is conducted to restore the plurality of data blocks to obtain non- 
corrupted data. 

10. A method as recited in claim 8, wherein the act of restoring comprises the 
act of applying the data blocks of the sequence of existing data blocks stored in the 



- Page 26 - 



Docket No 14113.26.1 



1 

2 
3 
4 
5 
6 
7 
8 
9 

10 
11 

12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 



preservation memory to a current version of the plurality of data blocks stored at the mass 
storage device in reverse chronological order. 

11. A method as recited in claim 9, wherein the act of restoring the plurality of 
data blocks is conducted to restore the plurality of data blocks to obtain non-corrupted 
data and wherein the act of applying the data blocks comprises the act of determining 
when the non-corrupted data is obtained. 

12. A method as recited in claim 1, further comprising the act of establishing a 
virtual device at the computer system that appears as if it contained the plurality of data 
blocks stored at the mass storage device in a state in which the plurality of data blocks 
existed at a previous point in time. 

13. A method as recited in claim 12, further comprising the acts of: 
receiving, at the virtual machine, a read request specifying a requested 

data block; and 

in response to the read request: 

if the preservation memory includes a copy of a non-corrupted 
version of the requested data block that was stored in the preservation 
memory at or after the previous point in time, processing the read request 
using the oldest such non-corrupted version of the requested data block 
stored in the preservation memory; and 

if the preservation memory does not include said copy of a non- 
corrupted version of the requested data block that was stored in the 
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preservation memory at or after the previous point in time, processing the 
read request using a version of the requested data block stored in the mass 
storage device. 
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14. In a computer system that includes a mass storage device that stores a 
plurality of data blocks, a method of restoring the data blocks of the mass storage device 
to a previous state, comprising the acts of: 

iteratively performing the acts of: 

receiving a write request that is to overwrite an existing data block 

in the mass storage device with a new data block; 

prior to executing the write request, storing a copy of the existing 

data block in a preservation memory associated with the computer system 

and associating a time stamp with the copy of the data block in the 

preservation memory; and 

executing the write request, such that the existing data block stored 

in the mass storage device is overwritten with the new data block; 

experiencing a data corruption event whereby at least one of the plurality 
of data blocks stored in the mass storage device becomes corrupted; and 

restoring the data blocks of the mass storage device to a previous state by 
applying the copies of the existing data blocks from the preservation memory to 
the plurality of data blocks of the mass storage device until the previous state is 
obtained. 

15. A method as recited in claim 14, wherein the reverse chronological order 
is identified using the time stamps associated with the copies of the existing data blocks. 
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16. A method as recited in claim 14, further comprising the act of creating a 
backup copy of the plurality of data blocks stored by the mass storage device prior to 
iteratively performing the act of receiving a write request. 

17. A method as recited in claim 16, wherein the act of restoring the data 
blocks is conducted such that the previous state represents non-corrupted data and is 
more recent than the backup copy. 

18. A method as recited in claim 14, wherein the iteratively performed act of 
storing a copy of the existing data block is performed on the data block level and 
independent of any file structure associated with the mass storage device. 

19. A method as recited in claim 18, wherein the plurality of data blocks 
represent data stored in specified sectors of the mass storage device. 
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20. In a computer system that includes a mass storage device that stores a 
plurality of data blocks, a method of establishing a virtual device that enables access to 
the plurality of data blocks as the data blocks existed at the mass storage device at a 
previous point in time, comprising the acts of: 

storing a current version of the plurality of data blocks in the mass storage 

device; 

maintaining, at a preservation memory associated with the computer 
system, copies of previous versions of data blocks that have since been 
overwritten at the mass storage device in response to write requests, the previous 
versions of the data blocks being associated with time stamps specifying a 
chronological order in which the data blocks were overwritten; 

providing access to the current version and the copies of the previous 
version through a virtual device, wherein the virtual device, in response to read 
request specifying a particular data block as it existed at the previous point in 
time, determines whether to access the current version of the data block from the 
mass storage device or the previous version of the data block from the 
preservation memory. 

21 . A method as recited in claim 20, wherein: 

the current version of the plurality of data blocks includes one or more 
corrupted data blocks; and 

at the previous point of time, the plurality of data blocks were non- 
corrupted. 



-Page 31 - 



Docket No. 14113.26.1 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 



22. A method as recited in claim 20, wherein, in response to the read request, 
the virtual device performs the acts of: 

if the preservation memory includes a copy of a non-corrupted version of 
the requested data block that was stored in the preservation memory at or after the 
previous point in time, processing the read request using the oldest such non- 
corrupted version of the requested data block stored in the preservation memory; 
and 

if the preservation memory does not include said copy of a non-corrupted 
version of the requested data block that was stored in the preservation memory at 
or after the previous point in time, processing the read request using a version of 
the requested data block stored in the mass storage device. 

23. A method as recited in claim 20, further comprising experiencing a data 
corruption event whereby one or more current version of a data block represents 
corrupted data, wherein the virtual device providing access to the plurality of data blocks 
as the data blocks existed at the mass storage device at a previous point in time in a non- 
corrupted state. 

24. A method as recited in claim 20, wherein the preservation memory 
comprises a portion of the mass storage device. 
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25. A computer system that provides access to data blocks as the data blocks 
existed at a previous point in time, comprising: 

a mass storage device that stores a plurality of data blocks that can be 
overwritten in response to a write request; 

a preservation memory that receives and stores a copies of the data blocks 
that are to be overwritten prior to the write request being processed and that 
associates a time stamp with each said copy of a data block; and 

a virtual device that provides access to a current version of the data blocks 
stored at the mass storage device and the copies of the data blocks at the 
preservation memory, wherein the virtual device, in response to read request 
specifying a particular data block as it existed at the previous point in time, 
determines whether to access a current version of the specified data block from 
the mass storage device or a copy of the specified data block from the 
preservation memory. 

26. A computer system as recited in claim 25, wherein the preservation 
memory comprises a portion of the mass storage device. 

27. A computer system as recited in claim 25, wherein the virtual device, from 
the standpoint of a data access program, appears as if it contained the data blocks as the 
data blocks existed in the mass storage device at the previous point in time. 

28. A computer system as recited in claim 25, wherein the virtual device, in 
response to the read request, performs the acts of: 
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if the preservation memory includes a copy of a non-corrupted version of 
the specified data block that was stored in the preservation memory at or after the 
previous point in time, processing the read request using the oldest such non- 
corrupted version of the specified data block stored in the preservation memory; 
and 

if the preservation memory does not include said copy of a non-corrupted 
version of the specified data block that was stored in the preservation memory at 
or after the previous point in time, processing the read request using a version of 
the specified data block stored in the mass storage device. 

29. A computer system as recited in claim 26, further comprising means for 
creating a backup copy of the data prior to receiving the write request. 
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